What Is URL Decoding And URL Encoding?

What Is a URL and Why Does Character Encoding Matter?

A URL (Uniform Resource Locator) is the address a browser uses to locate a resource on the internet. URLs can only contain characters from the US-ASCII character set, letters (a–z, A–Z), digits (0–9), and a small set of special characters. Any character outside this set must be encoded before it appears in a URL, or the browser will not be able to parse it correctly.

The structure of a URL, as defined by Tim Berners-Lee and formalised in RFC 3986, follows this generic syntax:

scheme:{//{user:password@}host{:port}}path{?query}{#fragment}

Certain parts, like the {user:password} section, are deprecated due to security risks. In practice, a typical URL looks like this:

https://example.com/page-1?q=search+term

Here, https is the scheme, example.com is the host, /page-1 is the path, and q=search+term is the query string.

What Are Reserved and Unreserved Characters in a URL?

RFC 3986 divides URL characters into two groups. Unreserved characters, letters, digits, hyphens, underscores, tildes, and periods, can appear anywhere in a URL without encoding. Reserved characters have specific structural meanings in URLs and must be encoded when used as data rather than as structure.

Reserved characters include: : / ? # [ ] @ ! $ & ' ( ) * + , ; =

If any of these appear in a data value (rather than as a structural delimiter), they must be percent-encoded so the server doesn't misinterpret them as part of the URL structure.

What Is URL Encoding (Percent-Encoding)?

URL encoding, also called percent-encoding, replaces unsafe or reserved characters with a percent sign (%) followed by two hexadecimal digits representing the character's byte value. When you encode a URL this way, every web browser and server can process the characters without ambiguity.

For example, a space character has the ASCII code 32, which in hexadecimal is 20. So a space becomes %20 in a URL. To decode percent encoding, you simply reverse the process, replace each %XX sequence with the character it represents.

Common URL Encoded Characters

Character	Encoded Form	Common Use Case
Space	%20	Search queries, file names with spaces
&	%26	Ampersand in query string values
#	%23	Hash symbol used as data, not a fragment
?	%3F	Question mark in data values
=	%3D	Equals sign in values (not key=value pairs)
+	%2B	Plus sign (+ also represents space in form data)
@	%40	Email addresses in query parameters
/	%2F	Forward slash used as data, not a path separator
%	%25	Literal percent sign in data values
:	%3A	Colon in path segments or query values
Newline	%0A	Line breaks in form-submitted text
Tab	%09	Tab characters in pasted data

What Are the Most Common Use Cases for URL Encoding?

URL encoding appears in several everyday web development contexts:

1. API Query Parameters

When passing data to an API via query strings, any special character in the value must be encoded. For example, if a user searches for "coffee & cake", the API request must encode the ampersand or the server will treat it as a parameter separator:

https://api.example.com/search?q=coffee%20%26%20cake

2. HTML Form Submissions

When a browser submits a form using the GET method, it encodes the form field values into the URL. Spaces are typically encoded as + in form data (application/x-www-form-urlencoded format), which differs slightly from standard percent-encoding where spaces are %20. This distinction matters when you're debugging search forms or URL parameters manually.

3. Internationalized URLs (Non-ASCII Characters)

URLs can only contain ASCII characters natively. If a URL needs to include characters from other alphabets, Arabic, Chinese, accented European characters, they must be encoded first. For example, the French word "café" in a URL becomes caf%C3%A9, where %C3%A9 is the UTF-8 percent-encoded form of the accented é character.

4. HTTP Redirect URLs

When a redirect URL is passed as a query parameter (common in login flows and OAuth), the entire destination URL must be encoded so the server can tell the redirect address apart from the query structure. For instance, redirecting to https://example.com/page?id=5 as a parameter would look like:

https://auth.example.com/login?redirect=https%3A%2F%2Fexample.com%2Fpage%3Fid%3D5

Without encoding, the server would misread the nested ? and = as part of the outer query string. If you need to decode an HTTP redirect URL like this, each %XX sequence converts back to its original character.

How Do Browsers Handle URL Encoding Automatically?

Modern browsers encode URLs automatically in most situations. When you type a URL with a space into the address bar, the browser converts it to %20 before sending the request. When you click a link with special characters in the href, the browser encodes them before the request leaves your machine.

This means most users never see encoded URLs, the browser handles the translation silently. But as a developer or site owner, encoding becomes visible and important when you're building URLs programmatically, debugging API calls, or analysing URLs in server logs.

How Do You Properly Encode a URL?

The key rule is to encode each section of the URL separately, never the entire URL as a single string. Encoding the whole URL at once will also encode the structural characters (like / and ?), which breaks the URL structure.

Take this example URL:

example.com/questions/what-is-the-question?#Answer#1

Encoded correctly, it becomes:

example.com/questions/what-is-the-question%3F/#Answer%231

Here, the ? in the path segment is encoded as %3F because it appears in the path (where it has no structural meaning), and # in the fragment identifier value is encoded as %23. The / between path segments is left unencoded because it is structural.

To avoid manual errors, use the free URL Decode & URL Encode tool, enter each path segment on a separate line and it returns the correctly encoded output for each part.

What Is URL Decoding?

URL decoding is the reverse of encoding. It converts percent-encoded sequences back into their original characters, making encoded URLs human-readable again. When you decode an encoded URL, each %XX pattern is replaced with the character it represents.

This is useful when you're reading server logs, debugging API responses, or identifying errors in URLs that have been encoded incorrectly. For example, decoding https://example.com/hello%20world%3F returns https://example.com/hello world?, showing you the original string before encoding was applied.

Decoding also helps identify problems. If a URL contains an accidentally encoded / that should be a path separator, decoding reveals it, and you can then fix the source to generate the correct URL structure.

How to Decode a URL

There are three practical ways to decode a percent-encoded URL, depending on your situation:

1. Use an Online URL Decoder

The fastest method. Paste your encoded URL into the URL Decode & URL Encode tool and click Decode. The tool instantly converts every %XX sequence, including Arabic, Hebrew, Chinese, and other non-Latin characters, back to readable text. No signup or installation required.

2. Use Browser Developer Tools

If you're working in a browser and want to decode a URL without leaving the page, open DevTools (F12 or right-click → Inspect), go to the Console tab, and run:

decodeURIComponent("your%20encoded%20url%20here")

This returns the decoded string immediately. It works in Chrome, Firefox, Edge, and Safari. Use decodeURI() instead if you want to preserve structural characters like / and ? in the output.

3. Decode in Code

If you're building an application and need to decode URLs programmatically, every major language has a built-in function:

• JavaScript: decodeURIComponent("encoded%20string")
• Python: urllib.parse.unquote("encoded%20string")
• PHP: rawurldecode("encoded%20string") for standard percent encoding, or urldecode() for form-encoded strings where spaces appear as +

For double-encoded URLs (where % itself was encoded, producing strings like %2520 instead of %20), run the decode function twice to get back to the original string.

How to URL Encode and Decode in JavaScript, Python, and PHP

Every major programming language has built-in functions to encode and decode URLs. Here is how to handle it in the three most common web languages.

JavaScript

JavaScript provides two pairs of functions for URL encoding:

• encodeURIComponent() / decodeURIComponent(), encode or decode a single URL component (a query parameter value, a path segment)
• encodeURI() / decodeURI(), encode or decode a full URL while preserving structural characters like /, ?, and #

Example, encode a search query:

encodeURIComponent("coffee & cake") // returns "coffee%20%26%20cake"

Example, decode an encoded URL:

decodeURIComponent("coffee%20%26%20cake") // returns "coffee & cake"

Python

Python's urllib.parse module handles URL encoding and decoding:

• urllib.parse.quote(), encode a string for use in a URL
• urllib.parse.unquote(), decode a URL-encoded string
• urllib.parse.urlencode(), encode a dictionary of key-value pairs into a query string

Example:

from urllib.parse import quote, unquote
quote("coffee & cake") # returns "coffee%20%26%20cake"
unquote("coffee%20%26%20cake") # returns "coffee & cake"

PHP

PHP offers two encoding functions with a subtle difference:

• rawurlencode() / rawurldecode(), encode spaces as %20 (standard percent encoding)
• urlencode() / urldecode(), encode spaces as + (application/x-www-form-urlencoded format)

Use rawurlencode() for URL path segments and urlencode() for form-style query strings. The decode functions reverse each format respectively.

encodeURI vs encodeURIComponent: Which One Should You Use?

This is one of the most common points of confusion in JavaScript URL handling. The difference is simple:

• encodeURIComponent() encodes everything except letters, digits, and - _ . ~ ! * ' ( ). Use it when encoding a single value that will go inside a URL, like a query parameter value or a path segment.
• encodeURI() encodes only characters that are not valid anywhere in a URL, but leaves structural characters like /, :, ?, #, and & untouched. Use it when encoding a complete URL string where the structure must stay intact.

When it matters: If you use encodeURI() on a query parameter value that contains &, the ampersand will not be encoded, and the server will misread it as a parameter separator. Always use encodeURIComponent() for individual values.

Quick rule: Encoding the whole URL? Use encodeURI(). Encoding a value inside a URL? Use encodeURIComponent().

Common URL Encoding Mistakes and How to Avoid Them

Even experienced developers run into URL encoding problems. Here are the most frequent mistakes and how to fix them.

1. Double Encoding

Double encoding happens when an already-encoded string gets encoded a second time. For example, %20 (an encoded space) becomes %2520 because the % sign itself gets encoded to %25. The result is a broken URL that shows literal %20 in the browser instead of a space.

How to avoid it: Always check whether your input is already encoded before running it through an encoding function. In PHP, avoid calling urlencode() on values from $_GET, PHP has already decoded them.

2. Encoding the Entire URL at Once

Passing a full URL through encodeURIComponent() will encode the /, :, and ? characters that form the URL's structure, producing something like https%3A%2F%2Fexample.com, which no browser can follow. Always encode individual components (path segments, query values), not the entire URL string.

3. Mixing + and %20 for Spaces

In the application/x-www-form-urlencoded format (used by HTML forms), spaces are encoded as +. In standard percent encoding (used in URL paths), spaces are %20. Mixing these up causes issues: a + in a URL path is treated as a literal plus sign, not a space. Use %20 in paths and + only in form-encoded query strings.

4. Forgetting to Encode Special Characters in Filenames

If your site serves files with names that contain spaces, parentheses, or non-ASCII characters, the download URLs must encode those characters. A file named report (final).pdf needs a URL like /files/report%20%28final%29.pdf. Forgetting this will return a 404 error.